Examkin

Tüm alıştırma soruları

502 soru

Tüm türler976Çoktan seçmeli502Çoklu seçim450Sıralama24
Soru 1Soru →

A SysOps Administrator initiates an update on an AWS CloudFormation stack. During the update, a resource creation fails. CloudFormation attempts to roll back the stack to its previous stable state, but the rollback process fails, leaving the stack in the UPDATE_ROLLBACK_FAILED state. Which of the following is a common cause for this rollback failure?

Cevabı ve açıklamayı göster

Cevap: A resource in the stack was manually deleted or modified outside of CloudFormation before the rollback was attempted.

Cevap

A resource in the stack was manually deleted or modified outside of CloudFormation before the rollback was attempted.
The correct answer is that a resource in the stack was manually deleted or modified outside of CloudFormation before the rollback was attempted. When resources are modified or deleted out-of-band, the stack suffers from drift. During a rollback, CloudFormation attempts to return the resources to their previous configuration. If a resource no longer exists or is in an unexpected state, the rollback operation will fail, placing the stack in the UPDATE_ROLLBACK_FAILED state.

Adım Adım Çözüm

1
Analyze the stack status transitions.
The stack went from UPDATE_IN_PROGRESS to UPDATE_ROLLBACK_IN_PROGRESS and finally to UPDATE_ROLLBACK_FAILED.
Understanding the status flow helps pinpoint where the failure occurred.
2
Determine why CloudFormation would fail to revert a resource during a rollback.
If the resource state has drifted or if the resource was deleted manually outside of CloudFormation, CloudFormation's internal engine cannot reconcile the expected state.
Identifying the root cause of rollback failures is key to resolving stack update errors.

Anahtar Kavram

AWS CloudFormation Rollback Failures and Drift Management
Soru 2Soru →

A SysOps administrator is configuring an Amazon EC2 Auto Scaling group (ASG) to launch instances using a new launch template. The launch template specifies an IAM instance profile with an associated IAM role for the instances. When the ASG attempts to launch instances to meet the desired capacity, all launch attempts fail with the status message: "You are not authorized to perform this operation." The administrator verified that the administrator's IAM identity has the necessary permissions to create the ASG and the launch template. Which configuration change will resolve the launch failures?

Cevabı ve açıklamayı göster

Cevap: Attach a policy to the administrator's IAM identity that grants the iam:PassRole permission for the ARN of the instance profile's IAM role.

Cevap

Attach a policy to the administrator's IAM identity that grants the iam:PassRole permission for the ARN of the instance profile's IAM role.
The correct answer is to attach a policy to the administrator's IAM identity that grants the iam:PassRole permission for the ARN of the instance profile's IAM role. AWS requires that any identity configuring an AWS service to act on its behalf must have permission to pass the associated role. Without this permission, the EC2 service cannot associate the IAM role with the newly launched instances, resulting in an authorization error.

Adım Adım Çözüm

1
Analyze the error message 'You are not authorized to perform this operation' in the ASG activity history.
Determine that the failure is caused by an IAM authorization issue when attempting to launch instances with an associated IAM role.
The launch template includes an IAM instance profile, meaning the launching entity must have permission to pass this role to EC2.
2
Identify the required IAM action for passing roles to AWS services.
The iam:PassRole action is identified as the required permission on the calling identity's policy.
AWS enforces iam:PassRole to prevent users from escalating their privileges by passing roles with greater permissions than they have.
3
Add the iam:PassRole permission targeting the specific IAM role ARN to the administrator's IAM policy.
The ASG successfully passes the IAM role to EC2, allowing instances to launch without authorization errors.
This completes the required permission chain for the ASG to launch instances with the specified IAM role.

Anahtar Kavram

IAM PassRole requirement for EC2 Auto Scaling launches
Soru 3Soru →

A SysOps Administrator is using AWS CodeDeploy to deploy an update to an application running on a fleet of Amazon EC2 instances. The deployment must guarantee that at least 75%75\% of the instances are healthy and serving traffic at any given time during the deployment. If any instance fails the update, the deployment must automatically revert to the previous working version.

Which configuration will meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Create a custom deployment configuration with the minimum healthy hosts set to 75%75\% using the percentage type, and configure the deployment group to roll back automatically when a deployment fails.

Cevap

Create a custom deployment configuration with the minimum healthy hosts set to 75%75\% using the percentage type, and configure the deployment group to roll back automatically when a deployment fails.
Creating a custom deployment configuration with the minimum healthy hosts set to 75%75\% ensures that CodeDeploy updates at most 25%25\% of the instances at a time, keeping at least 75%75\% of the fleet healthy. Enabling the automatic rollback option on deployment failure in the deployment group ensures that CodeDeploy automatically reverts to the last known good version if any instance fails to deploy successfully.

Adım Adım Çözüm

1
Determine the required minimum healthy host threshold and create a custom CodeDeploy deployment configuration.
A custom configuration is created specifying minimum healthy hosts as 75%75\% (percentage type).
Predefined configurations like HalfAtATime (50%50\%) or AllAtOnce (0%0\%) do not guarantee that at least 75%75\% of the fleet remains online.
2
Configure the rollback behavior on the CodeDeploy deployment group.
The deployment group is updated to automatically roll back when a deployment failure occurs.
This fulfills the requirement to automatically revert to the previous working version upon failure without manual intervention.
3
Execute the deployment specifying the newly created custom deployment configuration.
The deployment runs, updating at most 25%25\% of the instances at any time, and automatically rolls back if a failure is encountered.
This maintains the required application capacity and safety during the update process.

Anahtar Kavram

AWS CodeDeploy Deployment Configurations and Automatic Rollback Settings
Soru 4Soru →

A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB) in the us-east-1 Region. The company wants to set up an active-passive failover configuration at the zone apex (example.com). If the ALB or the backend instances become unhealthy, Route 53 must automatically redirect traffic to a static maintenance website hosted in an Amazon S3 bucket in the us-west-2 Region. Which configuration will meet these requirements with the fastest failover response and the least configuration overhead?

Cevabı ve açıklamayı göster

Cevap: Create an Alias record at the zone apex using a Failover routing policy. Set the primary record to point to the ALB with Evaluate Target Health set to Yes. Set the secondary record to point to the S3 bucket website endpoint.

Cevap

Create an Alias record at the zone apex using a Failover routing policy, pointing the primary record to the Application Load Balancer with Evaluate Target Health enabled, and pointing the secondary record to the Amazon S3 bucket website endpoint.
The correct option is the configuration that creates an Alias record at the zone apex using a Failover routing policy, points the primary record to the Application Load Balancer (ALB) with 'Evaluate Target Health' enabled, and points the secondary record to the Amazon S3 bucket website endpoint. This setup is standard, complies with zone apex limitations by using an Alias record instead of a CNAME, and provides rapid failover by having Route 53 directly evaluate the ALB target health without needing a separate health check or a delayed CloudWatch alarm.

Adım Adım Çözüm

1
Select the zone apex record (example.com) and set the routing policy to Failover.
Allows creation of primary and secondary records for active-passive failover.
Failover routing is the standard policy for active-passive disaster recovery setups.
2
Configure the primary record as an Alias record pointing to the Application Load Balancer, and set 'Evaluate Target Health' to Yes.
Route 53 will automatically check the health of the ALB and its targets without requiring a manual Route 53 health check setup.
Alias records to ALBs can leverage 'Evaluate Target Health' to quickly detect ALB target group health changes.
3
Configure the secondary record as an Alias record pointing to the S3 bucket website endpoint.
Traffic will failover to the S3 static website when the ALB is determined to be unhealthy.
Provides a cost-effective and highly available passive backup endpoint.

Anahtar Kavram

Route 53 active-passive DNS failover using Alias records and target health evaluation.
Soru 5Soru →

An organization wants to establish an automated response system when an Amazon EC2 instance's CPU utilization exceeds 95%95\% for more than 15 minutes, which indicates a runaway process. A SysOps administrator configures an Amazon EventBridge rule triggered by the corresponding Amazon CloudWatch alarm state change to `ALARM`. The remediation strategy is to trigger a custom AWS Systems Manager Automation runbook named `ResolveRunawayProcess` that will restart the problematic service on the instance. The runbook requires a service role (`SSMAutomationServiceRole`) to execute its steps. Which configuration and permission setup will successfully execute the remediation with the least privilege?

Cevabı ve açıklamayı göster

Cevap: Set the EventBridge rule target to Systems Manager Automation and select the ResolveRunawayProcess document. Assign an IAM role to the EventBridge target containing the ssm:StartAutomationExecution permission for the document and the iam:PassRole permission for the SSMAutomationServiceRole resource.

Cevap

Set the EventBridge rule target to Systems Manager Automation and select the ResolveRunawayProcess document. Assign an IAM role to the EventBridge target containing the ssm:StartAutomationExecution permission for the document and the iam:PassRole permission for the SSMAutomationServiceRole resource.
The correct configuration establishes a path where EventBridge acts as the caller. It invokes the Systems Manager Automation target (`ResolveRunawayProcess` document) and passes the execution role (`SSMAutomationServiceRole`) to Systems Manager using `iam:PassRole` permissions. Without `iam:PassRole`, Systems Manager cannot execute the Automation runbook steps under the specified service role context.

Adım Adım Çözüm

1
Identify the target orchestration service for the remediation.
The target must be Systems Manager Automation since the action requires executing a custom SSM Automation runbook.
Systems Manager Automation is the correct service for executing workflows/runbooks, unlike Run Command which executes scripts directly on managed instances.
2
Determine the necessary IAM permissions for EventBridge to invoke Systems Manager Automation.
The EventBridge execution role needs the ssm:StartAutomationExecution permission for the ResolveRunawayProcess document.
EventBridge must have explicit permission to trigger the execution of the target SSM document.
3
Configure the role-passing capability for the target execution.
Grant the EventBridge execution role iam:PassRole permission targeting the SSMAutomationServiceRole.
Since the Automation workflow executes steps using the SSMAutomationServiceRole, the calling service (EventBridge) must have permission to pass this execution role to Systems Manager.

Anahtar Kavram

EventBridge and Systems Manager Automation Remediation IAM Permissions
Soru 6Soru →

A SysOps administrator is configuring automated remediation to isolate Amazon EC2 instances when Amazon GuardDuty detects command-and-control (C&C) activity. The administrator wants to use Amazon EventBridge to detect the GuardDuty finding and trigger the AWS Systems Manager Automation document AWS-StopEC2Instance to stop the affected instance. Which combination of target configuration and IAM permissions will successfully implement this automated remediation?

Cevabı ve açıklamayı göster

Cevap: Configure the EventBridge rule with the Systems Manager Automation document as the target. Provide an IAM service role for EventBridge that allows the events.amazonaws.com service principal to assume it, and attach a policy allowing ssm:StartAutomationExecution for the target document and iam:PassRole for the Systems Manager Automation execution role.

Cevap

Configure the EventBridge rule with the Systems Manager Automation document as the target. Provide an IAM service role for EventBridge that allows the events.amazonaws.com service principal to assume it, and attach a policy allowing ssm:StartAutomationExecution for the target document and iam:PassRole for the Systems Manager Automation execution role.
The correct option correctly configures the EventBridge rule target to the Systems Manager Automation document, and grants EventBridge the necessary IAM permissions. Specifically, it allows EventBridge to assume a role to call ssm:StartAutomationExecution on the target document and includes the iam:PassRole permission so that EventBridge can pass the Systems Manager Automation execution role to the Systems Manager service, which executes the actions.

Adım Adım Çözüm

1
Configure the Amazon EventBridge rule pattern to match Amazon GuardDuty findings representing command-and-control activity.
GuardDuty finding events will match the rule pattern and trigger the designated targets.
This establishes the detection trigger in the event flow.
2
Set the EventBridge rule target to the AWS Systems Manager Automation document AWS-StopEC2Instance, specifying the EC2 instance ID from the event as a parameter.
The target document is selected and mapped to the affected resource.
This establishes the remediation action in the event flow.
3
Create an IAM role for EventBridge with a trust policy allowing events.amazonaws.com and a permissions policy allowing ssm:StartAutomationExecution and iam:PassRole for the execution role.
EventBridge receives permissions to execute the automation and pass the necessary service role to Systems Manager.
EventBridge requires these permissions to initiate the automation run under the context of the automation execution role.

Anahtar Kavram

Configuring event-driven automated remediation using Amazon EventBridge and AWS Systems Manager Automation requires setting up an IAM service role for EventBridge with both the ssm:StartAutomationExecution permission and the iam:PassRole permission to securely pass the execution role to Systems Manager.
Tahmini Süre:3m 0s
Soru 7Soru →

A company is designing a backup, restore, and high availability strategy for a critical transactional database running on Amazon RDS. The SysOps Administrator must satisfy the following requirements:
1. Automated daily backups must be replicated to a destination bucket in a secondary AWS Region.
2. In the event of an Availability Zone outage, the database must automatically failover to a standby instance in another Availability Zone within 2 minutes without requiring changes to application connection strings.
3. The replicated backups must be encrypted with a Customer Managed Key (CMK) in the destination Region, and access to decrypt these backups must be managed using IAM policies.

Which configuration must the SysOps Administrator implement to satisfy these requirements?

Cevabı ve açıklamayı göster

Cevap: Configure the primary database to use Multi-AZ deployment. Enable S3 versioning on both the source and destination buckets, and configure S3 Cross-Region Replication (CRR) to copy the backups. In the destination Region, configure the KMS key policy to allow the destination account's root principal to delegate key permissions, then use IAM policies to grant decrypt permissions to authorized users.

Cevap

Configure the primary database to use Multi-AZ deployment, enable S3 versioning on both the source and destination buckets for CRR, and modify the destination KMS key policy to allow the root principal to delegate key permissions via IAM.
The correct configuration combines Multi-AZ deployment to achieve automated, synchronous failover within 2 minutes without altering connection strings, enables S3 versioning on both buckets to allow S3 Cross-Region Replication (CRR) of the database backups, and configures the destination KMS key policy to permit the root principal to delegate key operations, enabling IAM policies to successfully control decryption access.

Adım Adım Çözüm

1
Select Multi-AZ deployment for Amazon RDS
Synchronous database replication is established across Availability Zones, enabling automatic DNS failover in under 2 minutes without endpoint changes.
Meets the high availability RTO requirement without requiring application configuration changes.
2
Enable S3 versioning on the source and destination buckets and configure S3 CRR
Automated backups uploaded to the source S3 bucket are successfully replicated to the secondary Region destination S3 bucket.
S3 Cross-Region Replication has a hard prerequisite that versioning must be enabled on both source and destination buckets.
3
Modify the Customer Managed Key (CMK) policy in the destination Region to enable IAM policy delegation
The KMS key policy includes the default statement allowing the root principal (`arn:aws:iam::ACCOUNT_ID:root`) to perform key actions, which delegates policy control to IAM.
Without this statement in the KMS key policy, IAM policies cannot grant permissions to access or decrypt using the KMS key due to KMS policy evaluation precedence.

Anahtar Kavram

Integrating high availability, backup replication prerequisites, and KMS key policy delegation
Soru 8Soru →

A SysOps administrator needs to configure active-passive DNS failover for a public-facing API. The primary endpoint is hosted in an on-premises datacenter, and the secondary disaster recovery endpoint is hosted on an Amazon EC2 instance in AWS. If the on-premises endpoint becomes unreachable, Route 53 must automatically redirect traffic to the EC2 instance. How should the administrator configure Amazon Route 53 to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Configure a Route 53 health check for the on-premises endpoint. Create a primary record with a Failover routing policy pointing to the on-premises IP address and associate it with the health check. Create a secondary record with a Failover routing policy pointing to the EC2 instance IP address.

Cevap

Configure a Route 53 health check for the on-premises endpoint. Create a primary record with a Failover routing policy pointing to the on-premises IP address and associate it with the health check. Create a secondary record with a Failover routing policy pointing to the EC2 instance IP address.
The correct configuration is to configure a Route 53 health check for the on-premises endpoint, then create a primary record with a Failover routing policy pointing to the on-premises IP address and associate it with the health check, and finally create a secondary record with a Failover routing policy pointing to the EC2 instance IP address. This properly defines an active-passive failover configuration where DNS queries resolve to the primary endpoint until the associated health check fails, at which point Route 53 begins responding with the secondary endpoint IP address.

Adım Adım Çözüm

1
Create a Route 53 health check that monitors the IP address or domain name of the primary on-premises API endpoint.
Amazon Route 53 will begin actively probing the on-premises endpoint to determine its health status.
Route 53 requires a health check to monitor the primary record's health state before it can execute an automated failover.
2
Create the primary DNS record in the hosted zone using the Failover routing policy, point it to the on-premises IP, and associate it with the created health check.
A primary failover record is established with an active monitor.
This establishes the default path for client traffic under normal operating conditions.
3
Create the secondary DNS record with the same record name, select the Failover routing policy, configure it as the secondary record, and point it to the EC2 instance's public IP address.
A secondary failover record is created.
This provides a backup destination for DNS queries when Route 53 detects that the primary endpoint is unhealthy.

Anahtar Kavram

Route 53 active-passive DNS failover requires a primary record with a health check and a secondary record, both configured with the Failover routing policy.
Soru 9Soru →

A SysOps administrator uses AWS CloudFormation to manage a production stack that includes an Amazon EC2 Auto Scaling group (ASG) behind an Application Load Balancer. The administrator attempts to update the application by modifying the CloudFormation template to use a new launch template. The new launch template specifies a new IAM instance profile with a new IAM role. The CloudFormation stack update is initiated using a dedicated IAM execution role.

During the deployment, the update fails on the ASG resource, causing CloudFormation to transition the stack to the UPDATE_ROLLBACK_IN_PROGRESS state. Shortly after, the stack status changes to UPDATE_ROLLBACK_FAILED. The CloudFormation event log shows an access denied error stating that CloudFormation is not authorized to associate the old IAM instance profile's role with the ASG's launch template.

How should the administrator resolve this issue to allow the rollback to complete successfully?

Cevabı ve açıklamayı göster

Cevap: Update the IAM policy attached to the CloudFormation execution role to include the iam:PassRole permission for the original IAM role used in the previous launch template, and then execute the ContinueUpdateRollback action on the stack.

Cevap

Update the IAM policy attached to the CloudFormation execution role to include the iam:PassRole permission for the original IAM role used in the previous launch template, and then execute the ContinueUpdateRollback action on the stack.
The correct solution is to update the CloudFormation execution role's IAM policy to grant the iam:PassRole permission for the original role, and then run ContinueUpdateRollback. This is because CloudFormation needs explicit permission to pass the original role to the Auto Scaling group when rolling back the launch template. When a stack is in the UPDATE_ROLLBACK_FAILED state, the ContinueUpdateRollback action is the standard AWS mechanism to resume the rollback process after the block is resolved.

Adım Adım Çözüm

1
Analyze the CloudFormation event log error details.
Identify that the failure is due to an Access Denied error when CloudFormation attempts to associate the previous launch template's IAM role with the Auto Scaling Group.
To determine the exact permission or resource constraint causing the rollback failure.
2
Identify the missing IAM permission required for the rollback.
Determine that the CloudFormation execution role requires the iam:PassRole permission for the original IAM role, because CloudFormation is passing that role back to the Auto Scaling Group.
When reverting a resource that uses an IAM role to its previous state, the execution entity must be authorized to pass the original role, not just the newly proposed role.
3
Update the IAM policy of the CloudFormation execution role.
Add the iam:PassRole permission for the Amazon Resource Name (ARN) of the original IAM role.
To authorize CloudFormation to perform the role assignment required for the rollback.
4
Execute the ContinueUpdateRollback command on the CloudFormation stack.
CloudFormation resumes the rollback process, successfully configures the ASG back to the previous launch template, and transitions the stack to UPDATE_ROLLBACK_COMPLETE.
A stack in the UPDATE_ROLLBACK_FAILED state must be explicitly instructed to resume rolling back using the ContinueUpdateRollback operation once the blocking issue is resolved.

Anahtar Kavram

Troubleshooting CloudFormation stack updates and rollbacks involving IAM PassRole permissions
Soru 10Soru →

A SysOps Administrator is managing cross-Region disaster recovery using AWS Elastic Disaster Recovery (AWS DRS) to protect a critical business application. The application's EC2 instances in us-east-1 are replicated to a staging area in us-west-2. The instances are configured with an IAM instance profile associated with a role named ApplicationStorageAccessRole that permits access to Amazon S3. During a disaster recovery drill in us-west-2, the administrator attempts to launch recovery instances, but the launch fails. The EC2 launch history shows an authorization error indicating that the administrator is not authorized to perform the action on the resource. Which action must the administrator take to successfully launch the recovery instances during the drill?

Cevabı ve açıklamayı göster

Cevap: Add the iam:PassRole permission for the ApplicationStorageAccessRole to the IAM identity of the administrator initiating the drill.

Cevap

Add the iam:PassRole permission for the ApplicationStorageAccessRole to the IAM identity of the administrator initiating the drill.
To launch recovery instances with an IAM instance profile, the IAM identity initiating the drill or failover (the SysOps Administrator) must have the iam:PassRole permission for the IAM role associated with the instance profile. This allows the administrator to pass the role to the EC2 service when the instances are created in the target Region.

Adım Adım Çözüm

1
Identify the IAM role specified in the EC2 Launch Template of the source instances, which is ApplicationStorageAccessRole.
Confirming the target role that must be associated with the recovery instances.
AWS Elastic Disaster Recovery uses EC2 Launch Templates to launch target recovery instances with their original configurations, including IAM roles.
2
Evaluate the IAM permissions of the administrator initiating the disaster recovery drill.
Recognize that the administrator lacks the iam:PassRole permission for the ApplicationStorageAccessRole.
To prevent privilege escalation, AWS requires users who launch EC2 instances with an IAM role to possess the iam:PassRole permission for that specific role.
3
Add an IAM policy granting the iam:PassRole permission for the ApplicationStorageAccessRole to the administrator's IAM user or role.
The administrator is now authorized to initiate the drill launch with the instance profile.
This permission allows the administrator to pass the role to the EC2 service, enabling the launch of the recovery instances with the required role.

Anahtar Kavram

AWS Elastic Disaster Recovery (AWS DRS) utilizes EC2 Launch Templates to deploy target recovery instances. When these instances require an IAM role via an instance profile, the user initiating the recovery or drill must have the iam:PassRole permission for that role to successfully complete the launch.
Soru 11Soru →

A SysOps Administrator is configuring an AWS Lambda function in AWS Account 555555555555555555555555 to decrypt sensitive application configuration files. The configuration files are encrypted using a customer managed KMS key. The Administrator has attached an IAM policy to the Lambda function's execution role that grants permission for the `kms:Decrypt` action on the KMS key. However, when executing, the Lambda function fails with an AccessDeniedException during the decryption step.

Upon inspecting the KMS key policy, the Administrator finds only the following statement:

{
"Sid": "Allow Key Administration",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::555555555555:role/SysOpsAdminRole"
},
"Action": "kms:*",
"Resource": "*"
}

Which modification to the KMS key policy will resolve this issue by allowing the Lambda function's IAM policy to take effect?

Cevabı ve açıklamayı göster

Cevap: Add a statement to the KMS key policy that grants the root user of account 555555555555555555555555 (`arn:aws:iam::555555555555:root`) permissions for all KMS actions (`kms:*`).

Cevap

Add a statement to the KMS key policy that grants the root user of the account (`arn:aws:iam::555555555555:root`) permissions for all KMS actions (`kms:*`).
In AWS KMS, for IAM policies to grant access to a customer managed key, the key policy must contain a statement that delegates authority to the AWS account. This is typically done by granting the root user principal (`arn:aws:iam::account-id:root`) permission to perform actions on the key. Once this statement is present, AWS evaluates both the key policy and the IAM policies. Since the Lambda execution role already has an IAM policy allowing `kms:Decrypt`, adding the account root principal statement to the key policy resolves the AccessDeniedException.

Adım Adım Çözüm

1
Analyze the existing configurations of the Lambda execution role and the KMS key policy.
The Lambda role contains a policy granting `kms:Decrypt`. However, the KMS key policy only lists a specific administrator role (`SysOpsAdminRole`) and does not grant the account root principal permission to manage permissions via IAM.
By default, KMS key policies must explicitly delegate permission authority to the AWS account for any IAM policies within that account to have effect on the key.
2
Identify the standard delegation statement required in KMS key policies.
The statement must target the AWS account root principal (`arn:aws:iam::555555555555:root`) and grant `kms:*` permissions.
This configuration establishes the link between the key policy and IAM policies, allowing AWS to evaluate IAM policies for roles or users attempting to access the key.
3
Select the option that implements this configuration.
Adding a statement to the key policy that permits the account root user enables evaluation of the Lambda function's execution role policy, resolving the AccessDeniedException.
Once the root user is added to the key policy, the Lambda execution role's policy is successfully evaluated, granting the necessary decryption permissions.

Anahtar Kavram

AWS KMS Key Policy Delegation to IAM
Soru 12Soru →

An organization has a fleet of Ubuntu Amazon EC2 instances. A SysOps Administrator creates a custom patch baseline in AWS Systems Manager Patch Manager to control which security updates are installed. The administrator registers a patch group named 'ubuntu-prod' with this custom baseline. During a scheduled maintenance window, the administrator observes that the instances are being patched, but they are receiving updates from the default AWS-provided patch baseline rather than the custom baseline.

Which of the following is the most likely cause of this behavior?

Cevabı ve açıklamayı göster

Cevap: The EC2 instances are tagged with the key 'PatchGroup' and the value 'ubuntu-prod'.

Cevap

The EC2 instances are tagged with the key 'PatchGroup' and the value 'ubuntu-prod'.
For AWS Systems Manager Patch Manager to associate an instance with a patch group, the instance must have a tag with the exact case-sensitive key 'Patch Group' (with a space). If the tag key is 'PatchGroup' (without a space), Systems Manager fails to map the instance to the 'ubuntu-prod' patch group, causing Patch Manager to apply the default AWS-provided patch baseline instead.

Adım Adım Çözüm

1
Analyze the observed behavior where instances are successfully patched but are using the default baseline instead of the custom baseline.
This indicates that the Systems Manager agent is functioning and the maintenance window is executing, but the instances are not being associated with the registered patch group 'ubuntu-prod'.
When an instance is not successfully matched to a patch group, Systems Manager Patch Manager falls back to the default baseline for that operating system.
2
Verify the requirements for defining and matching patch groups on EC2 instances.
AWS Systems Manager requires managed nodes to be tagged with the exact case-sensitive key 'Patch Group' (with a space) and the value matching the registered patch group name.
Any deviation in the tag key, such as using 'PatchGroup' or 'patch_group', will cause the baseline mapping to fail.

Anahtar Kavram

AWS Systems Manager Patch Group Tagging Requirements
Soru 13Soru →

An organization's Amazon EC2 instances located in a private subnet are experiencing connection timeouts when trying to access Amazon S3. A Gateway VPC Endpoint for Amazon S3 has been deployed and linked to the private subnet's route table. The instances use a security group that permits all egress traffic. The subnet's custom Network ACL has an egress rule allowing port 443443 traffic to the S3 prefix list, but all custom ingress rules have been removed, leaving only the default deny rule. What configuration change is necessary to restore access to Amazon S3?

Cevabı ve açıklamayı göster

Cevap: Configure an inbound rule in the custom Network ACL to allow traffic from the Amazon S3 prefix list on ephemeral ports 10241024-6553565535.

Cevap

Configure an inbound rule in the custom Network ACL to allow traffic from the Amazon S3 prefix list on ephemeral ports 10241024-6553565535.
Network ACLs are stateless, meaning both inbound and outbound traffic must be explicitly permitted. While the security group automatically tracks states, the custom Network ACL requires a return rule. S3 response traffic uses ephemeral ports 10241024-6553565535, so adding an inbound rule in the Network ACL for this range resolves the connection timeout.

Adım Adım Çözüm

1
Analyze the network route configuration for S3 traffic.
The route table is already associated with the S3 Gateway VPC Endpoint, indicating that the routing layer is correctly configured to redirect S3 traffic through the gateway endpoint.
Before troubleshooting security controls, verifying that a route to the target destination exists ensures routing is correct.
2
Examine the stateful and stateless security configurations.
The security group is stateful and permits outbound traffic, which automatically allows return traffic. The custom Network ACL is stateless and only contains an outbound rule for port 443443, meaning inbound response traffic is blocked by the default deny rule.
Since Network ACLs are stateless, they evaluate inbound and outbound traffic independently. Ephemeral ports must be opened for return traffic.
3
Identify the appropriate source and port range for the inbound rule.
Configure the inbound rule with the source as the S3 prefix list and the port range as ephemeral ports 10241024-6553565535.
S3 initiates connections back to the client using ephemeral ports, so the stateless return path must permit this range.

Anahtar Kavram

Stateless nature of Network Access Control Lists (NACLs) and ephemeral port requirements for return traffic
Tahmini Süre:2m 30s
Soru 14Soru →

A SysOps Administrator is reviewing optimization opportunities for a memory-bound Lambda function that processes incoming file uploads. The administrator wants to use AWS Compute Optimizer to determine the most cost-effective memory configuration for the function without sacrificing performance. Currently, the Compute Optimizer console shows no recommendations for this Lambda function. Which of the following requirements must be met before AWS Compute Optimizer can generate memory size recommendations for the Lambda function?

Cevabı ve açıklamayı göster

Cevap: The Lambda function must have been invoked at least 50 times over the past 14 days.

Cevap

The Lambda function must have been invoked at least 50 times over the past 14 days.
AWS Compute Optimizer natively analyzes the execution history of Lambda functions from CloudWatch Logs. To generate accurate memory recommendations, the service requires a minimum invocation history of at least 50 invocations over a 14-day lookback period.

Adım Adım Çözüm

1
Identify the target resource and metric source for optimization.
The target is an AWS Lambda function, and Compute Optimizer analyzes its memory allocation natively using CloudWatch Logs metadata (such as memory used vs. memory configured in the REPORT lines).
Understanding where Compute Optimizer gathers metrics helps rule out options requiring additional agents or configuration.
2
Recall the minimum baseline data requirements for AWS Compute Optimizer.
Compute Optimizer needs a minimum history of 50 invocations over the last 14 days to build a baseline for recommending memory adjustments.
A minimum threshold ensures recommendations are statistically valid and accurate.

Anahtar Kavram

AWS Compute Optimizer requirements for AWS Lambda memory optimization
Soru 15Soru →

A SysOps Administrator is optimizing the performance and cost of a transactional database hosted on an Amazon EC2 instance. The database is currently backed by a 1 TiB1\text{ TiB} Amazon EBS io2\text{io2} volume configured with 10,00010,000 Provisioned IOPS. Over the past 1414 days, Amazon CloudWatch metrics indicate that the volume's IOPS utilization consistently peaks at 2,2002,200 IOPS, and throughput peaks at 150 MiB/s150\text{ MiB/s}. AWS Compute Optimizer flags this volume as 'Overprovisioned'.

Which action should the administrator take to implement Compute Optimizer's recommendation and optimize costs without impacting application performance?

Cevabı ve açıklamayı göster

Cevap: Modify the EBS volume in-place to change the volume type to gp3, configuring the volume with 3,000 IOPS and 150 MiB/s throughput.

Cevap

Modify the EBS volume in-place to change the volume type to gp3, configuring the volume with 3,000 IOPS and 150 MiB/s throughput.
Modifying the EBS volume in-place to change the volume type to gp3 with 3,000 IOPS and 150 MiB/s throughput is correct because it aligns with Compute Optimizer's recommendation. A gp3 volume offers 3,000 baseline IOPS and 125 MiB/s throughput for free. Increasing the throughput to 150 MiB/s satisfies the database's peak performance demands (2,200 IOPS and 150 MiB/s) while significantly reducing provisioned costs compared to the expensive io2 volume.

Adım Adım Çözüm

1
Analyze the peak workload metrics from the past 1414 days, identifying that the database requires a maximum of 2,2002,200 IOPS and 150 MiB/s150\text{ MiB/s} throughput.
The requirements are within the capabilities of a gp3 volume, which offers 3,0003,000 baseline IOPS and customizable throughput.
This establishes the minimum performance target needed to maintain database performance without overprovisioning.
2
Determine the optimal configuration for a gp3 volume to meet these metrics.
A gp3 volume configured with 3,0003,000 baseline IOPS (included) and 150 MiB/s150\text{ MiB/s} throughput (25 MiB/s25\text{ MiB/s} provisioned above the baseline 125 MiB/s125\text{ MiB/s}).
This configuration satisfies both the peak IOPS and peak throughput requirements while avoiding excess provisioned resources.
3
Perform an in-place EBS volume modification to change the volume type from io2 to gp3 with the determined settings.
The volume type is modified online without performance degradation or downtime.
EBS elastic volumes allow live modification of volume types, size, IOPS, and throughput.

Anahtar Kavram

AWS Compute Optimizer helps right-size EBS volumes by analyzing performance metrics and suggesting cost-effective alternatives like gp3 for overprovisioned io1/io2 volumes.
Soru 16Soru →

A SysOps Administrator is configuring an AWS Config rule to monitor whether Amazon EC2 instances have public IP addresses. The administrator sets up automatic remediation using the AWS-StopEC2Instance Systems Manager (SSM) Automation document. The administrator creates an IAM role named ConfigRemediationRole that has a trust relationship with ssm.amazonaws.com and has the necessary permissions to stop EC2 instances. When the administrator attempts to associate this role with the AWS Config remediation configuration, the AWS Config console displays an error: 'Insufficient permissions to pass the remediation role.' Which action will resolve this issue?

Cevabı ve açıklamayı göster

Cevap: Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the ConfigRemediationRole resource.

Cevap

Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the ConfigRemediationRole resource.
The correct answer is to grant the administrator the iam:PassRole permission. When configuring AWS services to act on your behalf using an IAM role, your IAM identity (user or role) must be authorized to pass that role. Without this permission, the AWS Config console and API prevent you from completing the configuration to protect against unauthorized privilege escalation.

Adım Adım Çözüm

1
Identify the role delegation flow in AWS Config automated remediation.
AWS Config uses AWS Systems Manager (SSM) Automation to execute remediation. The user configuring this setup must pass an IAM execution role to the SSM service.
Understanding the service interaction helps pinpoint which permissions are required for the configuration step.
2
Analyze the error message 'Insufficient permissions to pass the remediation role'.
The error explicitly indicates a failure in the iam:PassRole authorization check for the administrator's identity.
When an AWS service or user associates an IAM role with a service, the user's IAM identity must be explicitly authorized to pass that role.
3
Determine the correct policy configuration to authorize role passage.
Attach a policy with iam:PassRole to the administrator's IAM user or role, targeting the ARN of ConfigRemediationRole.
This grants the administrator the necessary privilege to complete the configuration of the automated remediation.

Anahtar Kavram

AWS Config automated remediation and IAM role delegation (iam:PassRole requirements)
Soru 17Soru →

A SysOps Administrator is managing a web application that uses Amazon Route 53 for DNS resolution. The administrator configures Geolocation routing for `app.example.com` to route users in Europe to an Application Load Balancer (ALB) in `eu-west-1` and users in Asia to an ALB in `ap-southeast-1`. Shortly after deployment, users in North America report that they receive DNS resolution errors when trying to access the application. Which configuration change should the administrator implement to resolve the DNS resolution errors for North American users?

Cevabı ve açıklamayı göster

Cevap: Create a third geolocation routing record for `app.example.com` with the location set to 'Default' and point it to one of the active ALBs.

Cevap

Create a third geolocation routing record for the subdomain with the location set to 'Default' pointing to one of the active Application Load Balancers.
The correct answer is to create a third geolocation routing record with the location set to 'Default' and point it to an active ALB. In Amazon Route 53, if geolocation routing is configured but a query originates from a region not explicitly mapped in any of the records, Route 53 returns a 'no answer' response (NXDOMAIN). Configuring a default record handles queries from all locations that are not explicitly mapped.

Adım Adım Çözüm

1
Analyze the DNS routing configuration and the failure scenario.
Identify that the current Geolocation routing policy only covers Europe and Asia, leaving other regions (like North America) without a matching route rule.
When Route 53 receives a DNS query from a location that does not match any existing geolocation record, it will return a DNS resolution error if no default fallback is configured.
2
Determine the appropriate Route 53 configuration to handle unmapped locations.
A geolocation record with the location set to 'Default' must be added to route unmatched queries.
The 'Default' location record matches all queries from locations that are not explicitly covered by another geolocation record in the set.
3
Map the 'Default' record to an active application endpoint.
Create the record pointing to one of the existing Application Load Balancers to serve traffic for users in North America and other unmapped regions.
This ensures high availability and continuous DNS resolution globally.

Anahtar Kavram

Route 53 Geolocation Routing Default Fallback Configuration
Tahmini Süre:1m 30s
Soru 18Soru →

A SysOps Administrator is hosting a public website on an Amazon EC2 instance within a VPC. The instance is in a subnet with an associated route table that has a default route (0.0.0.0/00.0.0.0/0) pointing to an Internet Gateway. The Security Group attached to the instance allows inbound TCP port 8080 traffic from all sources (0.0.0.0/00.0.0.0/0) and allows all outbound traffic. The Administrator associates a custom Network Access Control List (NACL) with the subnet. The NACL allows inbound TCP port 8080 traffic from all sources (0.0.0.0/00.0.0.0/0) and outbound TCP port 8080 traffic to all destinations (0.0.0.0/00.0.0.0/0). Users report that they cannot connect to the website. Which of the following is the most likely cause of this issue?

Cevabı ve açıklamayı göster

Cevap: The custom NACL outbound rules do not allow return traffic to the ephemeral port range (10241024-6553565535) of the clients.

Cevap

The custom NACL outbound rules do not allow return traffic to the ephemeral port range (10241024-6553565535) of the clients.
The correct answer is correct because Network Access Control Lists (NACLs) are stateless. When a client initiates a connection to a web server, the source port on the client is an ephemeral port (typically 10241024-6553565535). Although the NACL allows inbound traffic on port 8080 and outbound traffic on port 8080, the outbound response from the server is sent to the client's ephemeral port. Because the custom NACL does not have an outbound rule allowing traffic to the ephemeral port range, the return traffic is dropped.

Adım Adım Çözüm

1
Identify the statefulness of the firewalls involved.
Security Groups are stateful, meaning return traffic is automatically allowed. Network Access Control Lists (NACLs) are stateless, requiring explicit inbound and outbound rules for traffic flow.
To determine where the return traffic is being blocked in the network path.
2
Analyze the port requirements for the return traffic.
The client connects to port 8080 (destination) from a random source port in the ephemeral range (10241024-6553565535). The return traffic from the server will have a source port of 8080 and a destination port in the ephemeral range (10241024-6553565535).
To determine which port rules must be configured in the stateless NACL to allow return traffic.
3
Evaluate the custom NACL configuration against the port requirements.
The custom NACL only allows outbound traffic on TCP port 8080, which blocks the return traffic destined for the client's ephemeral ports.
To identify the root cause of the connection failure.

Anahtar Kavram

Stateless firewalls (NACLs) require explicit outbound rules for ephemeral ports to allow return traffic, whereas stateful firewalls (Security Groups) track connection states automatically.
Tahmini Süre:1m 30s
Soru 19Soru →

A SysOps Administrator is configuring a monitoring solution for a dynamic fleet of Amazon EC2 instances. The instances run a custom application that reports a custom metric named ActiveSessionsActiveSessions to Amazon CloudWatch. To monitor the overall session load, the administrator attempts to create a CloudWatch alarm based on a metric math expression that uses the SEARCHSEARCH function to dynamically locate and sum the ActiveSessionsActiveSessions metric across all instances in the Auto Scaling group. However, the administrator is unable to save the alarm due to a validation error.

Which of the following explains why this configuration failed?

Cevabı ve açıklamayı göster

Cevap: Amazon CloudWatch alarms do not support metric math expressions that contain a SEARCHSEARCH function.

Cevap

Amazon CloudWatch alarms do not support metric math expressions that contain a SEARCH function because the search query returns a dynamic number of time series that cannot be mapped to a static alarm configuration.
The correct answer states that Amazon CloudWatch alarms do not support metric math expressions containing a SEARCH function. While CloudWatch supports metric math for alarms (e.g., SUM, AVG), any expression containing a SEARCH function cannot be used to create an alarm. This is because search expressions return a dynamic number of time series (which can change as EC2 instances launch or terminate), whereas a CloudWatch alarm requires a stable number of time series to evaluate against a threshold.

Adım Adım Çözüm

1
Identify the configuration details of the CloudWatch alarm.
The alarm uses a metric math expression containing a SEARCHSEARCH function to aggregate a custom metric (ActiveSessionsActiveSessions) dynamically.
To understand the context of the validation failure when saving the alarm.
2
Analyze the limitations of CloudWatch alarms with respect to metric math and search functions.
Amazon CloudWatch allows metric math for alarms but explicitly prohibits using the SEARCHSEARCH function in an alarm's expression because the query's output can vary dynamically as instances scale in or out.
To pinpoint the exact reason for the validation error.
3
Evaluate alternative solutions to achieve the desired monitoring setup.
To aggregate custom metrics across a dynamic fleet, the administrator should publish pre-aggregated metrics at the application level or use CloudWatch Metric Streams / Contributor Insights rather than a dynamic search alarm.
To resolve the monitoring requirement within CloudWatch limits.

Anahtar Kavram

CloudWatch Alarm limitations with Metric Math and SEARCH expressions
Soru 20Soru →

An organization runs an application on Amazon EC2 instances in a private VPC subnet. The application frequently reads and writes data to an Amazon DynamoDB table. A SysOps Administrator notices a significant increase in NAT Gateway data processing charges. To eliminate these charges, the administrator deploys a Gateway VPC Endpoint for Amazon DynamoDB within the VPC. However, monitoring tools reveal that the EC2 instances are still routing all DynamoDB traffic through the NAT Gateway. Which of the following is the most likely cause of this behavior?

Cevabı ve açıklamayı göster

Cevap: The route table associated with the private subnet was not selected during the gateway endpoint configuration, preventing the DynamoDB prefix list route from being automatically added.

Cevap

The route table associated with the private subnet was not selected during the gateway endpoint configuration, preventing the DynamoDB prefix list route from being automatically added.
The correct option is that the private subnet's route table was not selected during the gateway endpoint configuration. Gateway VPC Endpoints function by automatically adding a route to the associated route tables. This route maps the prefix list of the destination service (e.g., DynamoDB) to the VPC endpoint ID. If the private subnet's route table is not selected during creation or update, the route is not added, and traffic continues to route through the default path (the NAT Gateway).

Adım Adım Çözüm

1
Identify the endpoint type required for Amazon DynamoDB.
DynamoDB uses a Gateway VPC Endpoint by default.
This determines how routing and network access controls are applied.
2
Analyze how Gateway VPC Endpoints modify routing.
They add a route mapping the DynamoDB prefix list (pl−xxxxxxpl-xxxxxx) to the gateway endpoint (vpce−xxxxxxvpce-xxxxxx) in associated route tables.
Traffic to DynamoDB is routed at the subnet level rather than resolving to private IP addresses on interface endpoints.
3
Diagnose why traffic is still routed to the NAT Gateway.
If the private subnet's route table was not selected during endpoint creation, the prefix list route is missing from that route table.
Without the prefix list route, traffic default-routes to the NAT Gateway.

Anahtar Kavram

Gateway VPC Endpoints route traffic using subnet route tables and prefix lists, without utilizing Elastic Network Interfaces, security groups, or private DNS settings.
Sayfa 1 / 26Sonraki
Tüm alıştırma soruları — AWS Certified SysOps Administrator - Associate | Examkin